This is a plain-English summary for owners, based on guidance from the Information Commissioner’s Office (ICO) as we read it in November 2026. It isn’t legal advice. If you handle sensitive data, or you’re unsure, ask a solicitor or call the ICO’s advice line on 0303 123 1113.
Does it apply to you?
Very probably. If your app holds a customer’s name and email address, a staff rota or a delivery address, that’s personal data, and your business is the “controller” responsible for it. Using an AI tool or an online service doesn’t pass that responsibility on to them.
What you need to have in place
1. Pay the data protection fee
Most organisations using personal information have to pay, unless they’re exempt. For a micro business it’s £52 a year, or £5 less by direct debit. The maximum penalty for not paying is £4,350.
2. Tell people what you do with their data
Your privacy notice needs to cover the app: what you collect, why, who else handles it and how long you keep it. Many were written before the system existed, so they don’t mention it.
3. Keep it secure
You have to use appropriate security. An app where a stranger can read your customer table doesn’t meet that, however it came about.
4. Know who your suppliers are
Your AI builder, database, email service and connectors are likely to be your “processors”, so you should have proper terms with them, usually in a data processing agreement. Find out where each one stores the data. Our tool pages set out what we found: for example, Base44 stores app data in the United States by default, and says that data on most plans can be used to train AI models.
5. Be able to respond to people
People can ask for a copy of their data, or ask you to correct or delete it. Could you do that in your system? Since the Data (Use and Access) Act 2025, you also have to help people who want to complain about how you use their data, for example with an electronic form, and acknowledge complaints within 30 days.
If something goes wrong: the 72-hour rule
A breach is wider than hacking. The ICO’s definition covers any security incident affecting the confidentiality, integrity or availability of personal data. So discovering that your customer table has been open could count, as could deleting records by accident.
- Do you have to report it? If a risk to people is likely, yes. If it’s unlikely, you don’t, but you should document why.
- Do you have to tell the people affected? If there’s a high risk to them, yes, without undue delay.
- What should you record? Keep a record of every personal data breach, whether you report it or not.
- What if you don’t have all the facts? Report it anyway. The ICO says you can provide more later.
- What if it was your supplier? It has to tell you, and you then decide whether to report it.
The ICO also tries to reassure people: “Not every breach reported to us results in formal action. Our main aim is to provide advice.” Failing to report can bring a fine, though, so it’s better not to sit on it. The ICO notes that this guidance is under review following the Data (Use and Access) Act, so check its current wording if you need it.
Here’s the practical trap. The ICO suggests you might contain a cyber incident by changing all the passwords. If only one person can do that, and they’re on a plane, your 72 hours are already running. That’s the key-person problem again.
Four questions for your home-grown system
- What personal data is in it? Include spreadsheets, connectors and email notifications.
- Where does it go? List every service, and its location. Are any of them outside the UK?
- Who can reach it? Staff, former staff, suppliers, and strangers if the rules are wrong.
- How long do you keep it? Most home-grown systems keep everything for ever, because no one ever decided otherwise.
Our audit sets out the facts on all four, so that you or your adviser can decide what to do. We aren’t lawyers, and we’ll tell you when you need one.
Questions
We only hold business contacts. Does it still apply?
Yes, for the most part. Jo.Bloggs@acme.co.uk is personal data, because it identifies a person. A generic address such as info@ generally isn’t.
Can we put customer data into an AI chat tool?
Be careful. Pasting customer data into a tool, or having your app send it, makes that tool part of your supply chain. Check its terms on storage and training, and whether your privacy notice covers it.
Sources
By Selwyn Doling, VibeTend. Last updated 6 November 2026.
